security: disable remote script execution and harden runtime

[any1tan]

Summary

• make execution of upstream JavaScript fail closed by default and require an explicit isolated-environment opt-in
• update the Node lockfile to clear dependency alerts
• run the container as a non-root user and exclude secrets/build artifacts
• add pinned security CI for dependency audit, Python validation, and container checks

Verification

• complete npm audit: 0
• Python compile/import checks: passed
• Docker image build: passed
• container runtime UID: non-root
• remote JavaScript execution flag: disabled by default

No production deployment is included.